Army_EITaaS_Statement_Of_Objectives_9JULY2019.pdf

Army – Enterprise Information

Technology as a Service (EITaaS)

Statement of Objectives

Solicitation Number: W15QKN-19-R-06JL

Version 1.0, 5 July 2019

Army – Enterprise Information Technology as a Service (EITaaS) Statement of Objectives (SOO)

Version 1.0, 2019-07-05 Page | 1

1. Overview 1 Today’s Army installation/administrative enterprise information technology is identified 2 as a weapons platform which enables the entire force to perform the Army’s 3 administrative and power projection tasks. Army installation operations depend on 4 timely, secure, and reliable delivery and transmission of data. Today, the Army owns 5 and operates its entire information technology (IT) and long-distance communications. 6 This current own/operate model produces slow rates of changes and technology 7 adoption that diverges from similar commercial offerings. 8

The Army is exploring a new approach for delivering the enterprise network and core 9 IT services: Enterprise IT as a Service (EITaaS). The EITaaS Pilot effort will assess 10 the achievability and feasibility for deployment of commercial solutions for data 11 transport, end-user device provision, and cloud services for selected Army 12 installations. 13

The EITaaS Pilot assessments will permit the Army to maximize the value of the 14 enterprise IT investments while still allowing the users to retain the ability to tailor their 15 services and service levels. The Army seeks to partner with commercial IT Service 16 Provider(s) to deliver innovative and modernized Solutions to transform IT services, 17 improve cyber readiness, and allow re-missioning of personnel to cyber warfighting 18 missions. 19

2. Purpose 20 The specific purpose of this EITaaS Pilot is to partner with industry to reform existing 21 and future Army EITaaS operations and services delivery through commercial services 22 in order to increase mission effectiveness, increase IT user efficiencies, and establish 23 standardized, innovative IT services. This Pilot will address the outcomes sought in 24 the approved and current “Enterprise Information Technology as a Service (EITaaS) 25 Initial Requirements Document”, provided separately. The Pilot focus is on the end 26 users’ and installation organizations’ mission needs, with outcomes that improve IT 27 availability, resiliency, security, and affordability while improving the end users’ 28 experience. 29

3. Scope 30 EITaaS will provide commercial delivery and management of IT services from the 31 enterprise to the point of need (user) securely. The EITaaS Solution will adhere to 32 applicable Federal Government Laws and Cybersecurity regulations and policies, until 33 any submitted waiver(s) are approved by the Government. During this pilot, the 34 EITaaS Provider will deliver an EITaaS Solution as a parallel/non-interfering network 35 and devices. The EITaaS Provider is responsible to provide its EITaaS Solution for 36 enterprise use up to three (3) designated Army Pilot Sites (one each Small, Medium 37 and Large, grouped in a “Set”) included in the Agreement Award. (See Figures 1, 2, 3 38 and paragraph 12, Place of Performance) 39

Prototype EITaaS Solutions shall connect, protect, store, and compute, with common 40 IT services, hardware, software, and networking infrastructure. The EITaaS Provider 41

Version 1.0, 2019-07-05 Page | 2 shall demonstrate the ability to establish a parallel IT network and services while 42 demonstrating the capability to transition existing IT services to a commercial EITaaS 43 Solution offering. Any co-use (ex, the Army has unused capacity on Switches, Routers 44 and Underground Fiber Lines.) of Government equipment must be documented in the 45 assessment and approved by the Government. The Government projects that only 46 non-interference co-use will be approved. 47

Additionally, the EITaaS Provider will demonstrate the ability to support joint cyber 48 security operations including (but not limited to) the sharing of security log, event 49 and incident data, and cooperative work with the Army designated Cyber Security 50 Service Providers (CSSPs) and Regional Cyber Centers. The EITaaS Solution will 51 demonstrate the capability to encrypt Army Data at Rest, Data in Transit/in Motion 52 and Data in Use throughout the network environment. The EITaaS Solution will 53 demonstrate the use of a Government approved encryption solution Commercial 54 Solution for Classified (CSfC). Any EITaaS Cross Domain Solution (CDS) to 55 transfer data between the classified and unclassified environments (low to high or 56 high to low) must be pre-approved by the Government. 57

The EITaaS Solution Identity and Access Management (IdAM) must integrate with 58 Enterprise Access Management Service-Army (EAMS-A). The EITaaS Provider is 59 responsible to protect against unauthorized user lateral movement within the EITaaS 60 Solution (e.g., control user communications across the environment he/she is set up 61 in). The EITaaS solution shall include a data centric protection solution by 62 leveraging existing Identity Access Management (IdAM) to grant secure access to 63 network assets. 64

Finally, the EITaaS Solution must interoperate with and as appropriate, integrate 65 with existing Government IT infrastructure applications and services to include: 66

Any Government activity determined to be outside of EITaaS (e.g., Morale 67 Welfare and Recreation (MWR) activities) 68

Information Technology Service Management (ITSM) processes including 69 Army Enterprise Service Desk (AESD). (e.g., sharing incident ticket 70 information with AESD while resolving all EITaaS Solution internal tickets.) 71

The EITaaS Pilot schedule, as defined by Phases I – V, include dependent sequential 72 tasks that are non-severable for the entire period of performance. Phase V is projected 73 as (up to) 60-Day transition Phase and will be initiated only after a determination from 74 the Government to Transition Out (Pilot ends) or Transition to Production/Sustainment 75 on the Sites where the Pilot is successful. Should the Government direct a Transition 76 Out, the Government will collaborate with the EITaaS Provider to plan in detail that 77 transition and to assess the actual time-line required. 78

Nine EITaaS Pilot Site Sets planned for FY19 – FY21, depicted in Figure 1 below, were 79 selected by a deliberate decision process as representative of the entire Army owned 80 inventory of 288 real property locations/installations worldwide. The groupings of Pilot 81 Site Sets by row provide a similar scope of installations classified as Small, Medium 82

Version 1.0, 2019-07-05 Page | 3 and Large with unique challenges within each and therefore will be kept as grouped by 83 row and by Fiscal Year order. Any resulting Agreement for Pilot Site Set (row) A – C 84 will be assigned by the Government through a deliberate decision process. The map 85 of the Continental United States is included to depict that the EITaaS Solution pilot 86 must demonstrate an ability to scale across any geo-political boundary. 87

Figure 1 - Planned EITaaS Pilot Site Sets 89

4. EITaaS Pilot Key Goals/Success Metrics and Production: 90 All of the EITaaS Pilot Sites (awarded by Set) will be assessed for demonstrated 91 performance with six metrics that will be used by the Government to measure success 92 of the Pilots by Phase and the readiness to move to Production. Specific Metric 93 Objectives are listed, followed by the definition of Production and the detailed Metric 94 Performance Thresholds: 95

4.1 Available: The EITaaS Solution (network, compute/store) is available to the end 96 user 24/7/365 and interoperable with non-EITaaS installations and the Joint Forces. 97

4.2 Resilient: The EITaaS Solution provides multiple methods for users to transmit and 98 access data in addition to restoration, continuity of operations and disaster 99 recovery. 100

Version 1.0, 2019-07-05 Page | 4

4.3 Secure: The EITaaS Solution provides security Solutions that meet or exceed 101 current Department of Defense (DoD) and Army standards. 102

4.3.a Acceptable Cybersecurity Risk – The commercial Risk Assessment of the 103 EITaaS Solution must result in an acceptable level of risk and obtain Government 104 approval before implementation. 105

4.3.b Approved Technologies – The EITaaS Provider will follow Government 106 direction to only employ technologies within the EITaaS Solution that are either on 107 the Approved Product List or a candidate for consideration for approval (that improve 108 national security). 109

4.4 End User Experience: The EITaaS Solution increases readiness through 110 enhanced End User experience and productivity as measured by a comparison of 111 the performance measured in the assessment and Government independent 112 assessment of the “as is” status. Two key measurements are: EITaaS Solution Latency 113 and Customer Satisfaction. 114

“End User” or “User” for this purpose of the EITaaS Pilot includes: All personnel 115 identified as “US Government Authorized Users” for the Department of the Army or 116 DoD network. This includes uniformed military, Government civilians and 117 Government Contractors and DoD/Army Government benefit recipients (e.g., those 118 registered in the Defense Enrollment Eligibility Reporting System (DEERS) to 119 include family members, students, retirees and those enrolled in the Veterans 120 Administration and approved guest(s) / visitors) on and off the designated Pilot 121 locations. The user’s “End User Experience” with the EITaaS Solution will be 122 dependent on the position/role that the individual holds with the range spanning from 123 a “user” that is direct recipient of an issued EITaaS End User Device and the EITaaS 124 applications to a “user” with a “bring-your-own-device” connecting to an EITaaS 125 provided wire-less internet connection in a customer service area. 126

4.5 Ability to Scale: The EITaaS Solution can scale to provide support to up to all of 127 the Army Installations within the Continental United States (CONUS) and Outside 128 CONUS (OCONUS) (up to 288 locations). This includes designated geographically 129 separated facilities (owned or leased) and support to uniformed military, Government 130 civilian and Government on-site support contractors at those facilities. 131

4.6 Affordable: The EITaaS Solution is efficient in its utilization of resources and 132 equipment to provide increased performance to users and organizations as 133 measured by the application of the EITaaS Provider cost model (working EITaaS 134 Solution Cost Model delivered in Phase 1) and as compared to the current 135 capabilities and Army IT investment (budget). 136

Version 1.0, 2019-07-05 Page | 5

4.7 Production Defined: 138

10 U.S.C. § 2371b(f) authorizes the Department of Defense (DoD) to structure OT 139 prototype agreements with the potential to award a follow-on production contract or 140 transaction to the participants in the transaction, without further competition. In order 141 to do so, two criteria must be met: 1) competitive procedures must be used to select 142 the performer and 2) the participants must have successfully completed the 143 prototype project provided for in the transaction. Any production award(s) will be the 144 result of competitive procedures through Prototype Project Opportunity Notice 145

(PPON) W15QKN-19-R-06JL. 146

In accordance with 10 U.S.C. § 2371b(f), this competitively awarded Agreement may 147 lead to follow-on production activities if the Key Technical Goals, as defined above in 148 paragraph 4. EITaaS Pilot Key Goals/Success Metrics (Available, Resilient, Secure, 149 End User Experience, and Ability to Scale) are met; or in the event that a particularly 150 favorable or unexpected result is accomplished that justifies transition to production. 151

The anticipated scale of a production follow-on is within the metric 4.5 Ability to 152 Scale - to provide support to up to all of the Army Installations within the Continental 153 United States (CONUS) and Outside CONUS (OCONUS) (up to 288 locations). 154 This includes designated geographically separated facilities (owned or leased) and 155 support to uniformed military, Government civilian and Government on-site support 156 contractors at those facilities. 157

4.8 Success Metrics and Performance Thresholds: The success metrics are 158 assigned definitions and minimum performance thresholds measurements in table 1 159 below: 160

Table 1 Success Metrics, Definitions and Performance Thresholds 162

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S) 1.

Availability

Amount of time the system or service is available to the user.

WAN: 99.99%

LAN: 99.99%

End User Services / Applications:

99.99%

Services, Storage, Collaboration Environments:

99.99%

2. a.

Resilience

Redundancy or failover to sustain high levels of availability.

Services:

Multiple, redundant communication paths must be greater than one.

Services: Multiple instances of services to ensure no single point of failure.

Devices:

Replacement devices or restoration of device functionality.

Services: Multiple instances of services or storage to ensure no single point of failure.

Version 1.0, 2019-07-05 Page | 6

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

2. b.

Restoration

Restore from service outages due to complete or partial failures of hardware and/or software components within any segment of the end-to-end network solution.

Each Incident will be assessed in terms of its Impact upon the Customer and the Urgency with which the Customer requires the Incident to be Resolved.

EITaaS Provider’s specific rule set for definitions of Impact Levels and Priority as documented in the Service Level Agreement.

Catastrophic Incident, Severity 1: < 15 Minutes per Event (Expected Service Level 98% of the time) Critical Incident, Priority 2: < 1 Hours per Event (Expected Service Level 98% of the time) Major Incident, Priority 3: < 4 Hours per Event (Expected Service Level 96% of the time) Normal Incident, Priority 4: < 2 Days per Event (Expected Service Level 94% of the time)

Catastrophic Incident, Severity 1: Same as LOE 1.1

Critical Incident, Priority 2: Same as LOE 1.1

Major Incident, Priority 3: Same as LOE 1.1

Normal Incident, Priority 4: Same as LOE 1.1

Catastrophic Incident, Severity 1: Same as LOE 1.1

Critical Incident, Priority 2: Same as LOE 1.1

Major Incident, Priority 3: Same as LOE 1.1

Normal Incident, Priority 4: Same as LOE 1.1

3. Secure Security of end-to-end network and services solution in accordance with applicable Government policy and Industry best practices.

Includes all necessary means to achieve a security posture where all vulnerability and risks are identified, assessed, mitigated, prevented, and remediated.

Monitoring, Detection, and Prevention of Vulnerabilities: 24 Hours Per Day, 365 Days Per Year

Vulnerability Incident Containment and remediation: < 4 Hours per Event

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Monitoring, Detection, and Prevention of Vulnerabilities:

Same as LOE 1.1

Vulnerability Incident Containment and remediation:

Same as LOE 1.1

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Monitoring, Detection, and Prevention of Vulnerabilities:

Same as LOE 1.1

Vulnerability Incident Containment and remediation:

Same as LOE 1.1

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Version 1.0, 2019-07-05 Page | 7

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S) 4.a.

End User Experience

- Latency

End User Experience as measured through EITaaS Solution Latency.

Maximum amount of elapsed time / round trip network transit delay from the end device ingress point to its intended egress point within the overall network solution.

WAN: < 180 ms LAN: < 50 ms

Maximum End-to- End Latency (From the Service Delivery Point to the End Device): < 250 ms

End User Access to Services, Device Response Time:

< 180 ms < 50 ms

Maximum End-to- End Latency:

Same as LOE 1.1

Access to Storage or Applications:

< 180 ms < 50 ms

Maximum End-to- End Latency:

Same as LOE 1.1

4.b.

End User Experience

- Customer Satisfaction

End User Experience as measured through Customer Satisfaction (Government) surveys collected with results aggregated.

Survey Scale:

5: Very Satisfied 4: Satisfied 3: Neither satisfied nor dissatisfied 2: Dissatisfied 1: Very Dissatisfied

Benchmark: 4.3 (86%) against daily, monthly survey results.

Govt Surveys collected.

Expected service level 4.3 of 5.0 or 86% of aggregated survey results for the time period.

Survey Questions Structured to Determine customer productivity in accomplishing their mission, responsiveness to customer needs, and usability of the EITaaS Solution(s).

Surveys – Same as LOE 1.1

Surveys – Same as LOE 1.1

5. Ability to Scale

Ability to Scale measured by the performance of the first Pilot Site (against the Metrics 1 – 4) as the EITaaS Solution is implemented and users/organizations are added at that site.

Additionally, if/when a second and/or third Pilot Sites are added, the metrics from the first Site will be the baseline for comparison of performance to the second and third Pilot Site after the increase in numbers of users, geographic locations, and capabilities.

NaaS: Maintain high levels of network capacity and availability as the user base increases.

EUD, EUS:

Maintaining high levels of user satisfaction while expanding user base, geographical, with additional capabilities.

C&S: Maintain high levels of performance (responsive, latency, availability, resilience) as user base, and capabilities scale to additional sites.

Version 1.0, 2019-07-05 Page | 8

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

Measurement of the performance of any centralized capabilities in the EITaaS Solution are spread across a broader user and geographic locations, allowing for the deployment of additional capabilities.

6.

Affordability

Resource strategy that optimizes investments, while costs are controlled with the addition of Scaling (Metric 5), increases in performance (Metrics 1, 2, 3) and retires underperforming legacy infrastructure.

Costs equal to industry standards for a as a service model.

Same as LOE 1.1 Same as LOE 1.1

5. EITaaS Pilot Lines of Effort (LOEs) Objectives 164 There are three (3) Lines of Effort (LOEs) in this EITaaS Pilot that will be implemented 165 at each of the designated Pilot Site locations at the same time (See Figure 1 above). 166 To achieve performance as an enterprise the EITaaS Solution must support all three 167 simultaneously at one or more designated Pilot Site(s). 168

The EITaaS Lines of Effort (LOEs) are: 169

LOE 1: Network as a Service (NaaS) 170

LOE 2: End User Services (EUS) 171

LOE 3: Compute and Store (C/S) 172

Version 1.0, 2019-07-05 Page | 9

Figure 2 - Army EITaaS Lines of Effort (LOE) 175

As an enterprise Solution, Identity and Access Management (IdAM) and security with 176 Data Protection at Rest and In-Transit apply to all LOEs. 177

The first LOE 1.1, Network as a Service (NaaS), includes Wide Area Networks 178 (WAN), Installation-Campus Area Network (ICAN), Capability for Army Unit’s Tactical 179 Network to connect/interconnect to Pilot Site/Installation Network (Installation as a 180 Docking Station), Land Mobile Radio (LMR), Enterprise Defense, Data Recovery, and 181 NIPR/SIPR Cross Domain Solution(s). 182

The second LOE 1.2, End User Services (EUS), includes End User Devices, 183 Information Technology Service Management (ITSM), Video Collaboration, Endpoint 184 Device management, multi-function device(s), Video Collaboration, User Provisioning, 185 Telephony, Pilot Site Emergency Communications, Unified Communications, Service 186 Level Catalog (based on user profiles) and Mobility Management. 187

The third LOE 1.3, Compute and Store (C&S) includes the Collaborative Data 188 Environment, Global Access to Data, the Installation Data Center and export to 189 designated Army Data Analytic Solutions. 190

Managed at the Enterprise level, detailed objectives include the following: 191

5.1 WAN: Demonstrate that the EITaaS Solution will provide a connection to 192 the Internet and authorized cloud providers from local installation and 193 remote users to ensure that Army organizations can operate installation 194 mission functions over an EITaaS Solution Wide Area Network that is 195 interoperable with all DoD, Joint, and potential multi-national systems and 196

Version 1.0, 2019-07-05 Page | 10 networks while improving throughput and minimizing latency. Connection to 197 authorized cloud providers and connect mission critical applications while 198 ensuring security of data. 199

5.2 ICAN: Demonstrate EITaaS Solution is capable of service and delivery to a 200 designated Pilot Site providing voice, data, wired and wireless, networking 201 functions and migrate those functions to a reliable and resilient commercial 202 service delivery model which meets or exceeds current delivery capabilities 203 and capacities. ICAN includes Data Recovery services, and capability for 204 Tactical Network connect/interconnect to Pilot Site/Installation Network 205 through their point of presence. 206

5.3 Network Performance: Demonstrate that the EITaaS Solution meets or 207 exceeds the availability threshold (Table 1, Metric 1), reduces logical and 208 physical bottlenecks, provides redundancy/failover through logical and 209 physical diversity (on and off installation). Through consistent, standardized 210 configurations and toolsets, the EITaaS Solution should reduce human 211 touch points with automated incident discovery and remediation. 212

5.4 Mission Effectiveness: Demonstrate that the EITaaS Solution provides 213 visibility and operational effectiveness to accomplish the Mission of the 214 designated Pilot Site(s), assigned units, organizations and end users. 215

5.5 Commercial Innovation: Demonstrate ability to of the EITaaS Provider to 216 partner with the Army to enhance the agility and cyber security of Army IT 217 operations. 218

5.6 End User Devices and Services: Demonstrate the implementation and 219 maintenance of a user-centric approach to end user devices and services. 220 User personas will enable access to the data, applications and services 221 they need to accomplish their missions. Devices will be user conduits to 222 authorized data, applications and services, regardless of device type, 223 including organizational multi-function devices for print, scan capability 224 while at work. Enable the capability to support Bring Your Own Device 225 (BYOD) to extend user capability with secure access and protection of 226 enterprise data and applications. Included services are: 227

a) User devices (laptops, tablets, phones, smartphones) 228

b) Printers 229

c) Video and VTC systems 230

d) Telephony systems 231

e) Unified Communications systems 232

f) Mobility management systems and methods 233

g) Asset visibility (End Device Management) 234

h) ITSM processes and Standard Operating Procedures 235

Version 1.0, 2019-07-05 Page | 11

i) Transition and Fielding management and support 236

j) Defense Enterprise Email and Defense Collaboration Services support 237

5.7 Account Management and Network Operations (NetOps): Demonstrate 238 that the EITaaS Solution can provide enterprise level account management 239 across networks, user accounts, applications, and system administrative 240 functions (e.g., authentication, account management, and request 241 fulfillment). 242

5.8 Identity and Access Management (IdAM): Demonstrate that the EITaaS 243 Solution shall reduce IdAM complexity (from user perspective, as compared 244 to the current process) while maintaining high levels of security with 245 solution(s) that rationalize multiple identities, personas, roles, while 246 factoring user "place" (e.g., Govt, public, home, domestic, foreign) to permit 247 seamless and secure access to the resources users need given their 248 situation. 249

5.9 Network Operations (NetOps) Collaboration: Demonstrate visibility of 250 assets and system performance through common toolkits, dashboards, and 251 analytics that provide a complete view for government and industry partners 252 that can be tiered and accessed based on organization, geography, 253 function, or capabilities. 254

5.10 Commercial Solutions for Classified (CSfC): Demonstrate use of the 255 National Security Agency’s (NSA) CSfC program to identify, configure, 256 deploy and sustain NSA-certified products that provide commercial, 257 affordable solutions that use commercial products in layered solutions, 258 capable of protecting classified Defense/National Security Systems (NSS) 259 information. 260

5.11 Mobility: Demonstrate secure, mobile solutions (e.g. BYOD) that 261 optimizes the end user experience. Provide device/persona access to the 262 resources needed from anywhere, anytime. 263

5.12 Land Mobile Radio (LMR): Demonstrate solutions for integration of non-264 tactical LMR systems in support of installation public safety, training, 265 organizations and functions. Including first responders, force protection and 266 other installation management functions that require local, state and federal 267 mutual aid interoperability, advanced encryption standards and priority 268 queuing for life and safety communications, as well as increased spectrum 269 efficiency. The LMR solution requires logging and archiving for emergency 270 voice communications as well as the ability to program and recover over the 271 air. Additionally the solution must have the ability to maintain trunked 272 communications through Graceful Systems Degradation. Solution must 273 support provide compatibility with current and future LMR upgrades that 274 typically entail system management centers, repeaters, dispatch consoles, 275 handheld, mobile and desktop radios, and antennas. All acquired systems 276 meet Association of Public-Safety Communications Officials (APCO) P25 277 standards. 278

Version 1.0, 2019-07-05 Page | 12

5.13 Compute and Store: Demonstrate that the EITaaS provider can 279 implement and manage cohesive, executable, and secure access to 280 applications, data, and compute and store infrastructure that optimizes 281 collaboration (team, organization, cross-organization), asset management, 282 and compute/store performance. To include: 283

a) Global data access and storage 284

b) Legacy data system and source support 285

c) Data centers and processing nodes 286

d) Definitive media library (DML) of all software in use 287

e) Data backup and recovery solutions 288

f) Collaborative data environment consisting of knowledge management, 289 workplace collaboration, document, individual storage, and workflow 290 management solutions 291

6. Schedule 293 The EITaaS Pilot schedule will cover up to 36 Months total, with five (5) defined 294 phases for each Pilot Site. Only the initial Pilot Site will have 36 Months of activity, 295 Pilot Site 2 and 3 will be shorter as determined by the staggered Fiscal Year Funded 296 awards. Each phase will be assessed against the EITaaS Provider’s plan of action 297 and milestones. Success must be achieved at each phase to be given the opportunity 298 to move to the next phase. Each phase period of performance is defined as “up to” 299 number of days. Initiation of activity at the next designated phase and Pilot Site 300 requires both Government approval and funding. 301

The EITaaS Provider’s detailed integrated master schedule will be reviewed at the 302 Kick Off meeting, “baselined” and incrementally evolved per the EITaaS Provider’s 303 process, with changes submitted for Government approval. At a minimum, the 304 schedule shall identify major project capability milestones, dependencies, work 305 breakdown structure, resources required (Government and Provider) and activities 306 associated with the project at the level of detail appropriate. 307

Five (5) EITaaS Phases planned for each Pilot Site location (Sequential at each 308 Pilot Site, based on demonstrated performance and funding available) 309

Phase I – Assessment (Up to 30 Days) at each awarded Pilot Site 310

Phase II – Plan and Prepare (Up to 180 Days / 6 Months for FY19 Site 1 [AFC, Polk 311 or Roberts], 6 Months for FY20 Site 2 [Leavenworth, Dugway or Benning] and 4 312 Months for FY21 Site 3 [Gordon, Huachuca or Irwin]) 313

Phase III – Implement (Up to 365 Days / 12 Months for FY19 Site 1 & FY20 Site 2 314 and 9 Months for FY21 Site 3) 315

Phase IV – Operate (Up to 519 Days / 15 Months for FY19 Site 1, Up to 9 Months for 316 FY20 Site 2 and 7 Months for FY21 Site 3) 317

Version 1.0, 2019-07-05 Page | 13

Phase V – Transition Out (End Support) or Transition to Production / Sustainment of 318 the approved Pilot Solution (Up to 60 Days). Any Transition to Production, will be in 319 parallel with Phase IV - Operate. 320

Figure 3 - EITaaS Notional Schedule 321

6.1 Phase I – Assessment (Up to 30 Days). This Phase begins no earlier than one 322

(1) business day after agreement award. The assessment will include an 323 analysis of the Government infrastructure and its capacity to provide a parallel 324 capability that is logically separate from the Government network. This Phase is 325 complete with the submission and Government acceptance of the Assessment 326 Findings, a working EITaaS Solution Cost Model and all other relevant deliverable 327 items in Table 2 – EITaaS Data Deliverables List. The Assessment deliverable is 328 a report/data that provides the EITaaS Provider and the Government an up-to-329 date inventory and assessment of the quality of the current installation IT 330 resources, to include end user devices. 331

6.2 Phase II – Plan and Prepare (Up to 180 Days / 6 Months for Site 1 & 2 and 4 332 Months for Site 3). This Phase begins no earlier than one (1) business day after 333 Phase I initial Assessment findings are available and approved by the EITaaS 334 Provider and the Government. The Plan for Phase II will include: 335

a) Any planned use of Government infrastructure capacity, if that capacity is 336 included in the EITaaS Solution (not a Government requirement) 337

b) Any new EITaaS Solution infrastructure that will be provided. 338

c) The Plan of Action and Milestones (POAM) for migration and validation of the 339 EITaaS Solution before implementation 340

d) Update the data deliverables, specifically the IMS and Working EITaaS 341 Solution Cost Model 342

Version 1.0, 2019-07-05 Page | 14

This phase is complete when all of the Hardware and Software needed to initiate 343 Phase III is on order or on-hand. The key deliverable is a resource loaded 344 integrated master schedule (IMS) that provides the detailed plan for implementing 345 the EITaaS Solution at the Pilot Site for the assigned organizations, units and 346 users. The IMS, or in a separate report, shall identify all of the Government 347 resources required. In addition to the IMS, the EITaaS Provider shall make 348 available all other Phase II relevant deliverable items in Table 2 – EITaaS Data 349 Deliverables List. Relevant to this phase are Network Architecture Diagrams that 350 depict the level of detail needed to inform the decisions to commit resources for 351 this Phase II and follow-on Phases and also the catalog of end user devices and 352 the distribution plan. 353

6.3 Phase III – Implement (Up to 365 Days / 12 Months for Site 1 & 2 and 9 Months 354 for Site 3). This Phase begins no earlier than when the EITaaS Provider is in 355 receipt of EITaaS hardware/software to be installed or configured to support the 356 designated Pilot Site with a parallel network as identified in the IMS. Initiation of 357 this phase with a partial inventory of resources is acceptable. The steps within 358 this phase include: 359

a) Build the EITaaS Solution 360

b) Validate the EITaaS Solution 361

c) Migrate – All Government services and users (identified in Phase I) over time 362 to the EITaaS Solution 363

d) Update the data deliverables, specifically the IMS and Working EITaaS 364 Solution Cost Model 365

In addition, the EITaaS Provider shall make available all other Phase III relevant 366 deliverable items in Table 2 – EITaaS Data Deliverables List. 367

6.4 Phase IV – Operate (Up to 520 Days / 15 Months for Site 1, Up to 9 Months for 368 Site 2 and 7 Months for Site 3). This Phase begins no earlier than when the 369 EITaaS Provider determines all hardware/software is on-hand/installed/configured 370 and the assigned Army organizations have Full Operational Capability (FOC) to 371 perform their normal functions / support using the EITaaS Solution. FOC of the 372 EITaaS Solution will be measured against the Phase I assessment (“as is”) 373 results and any additions/deletions (of organizations/units/missions) to the Pilot 374 Site over the Pilot period of performance. FOC will be met when the EITaaS 375 Solution demonstrates the Success Metrics in paragraph 4. Key to demonstrating 376 success, the EITaaS Provider shall make available all other Phase IV relevant 377 deliverable items in Table 2 – EITaaS Data Deliverables List. At month 34 of the 378 Period of Performance, the Government will initiate the assessment to move to 379 Phase V as Transition Out or Transition to Production/Sustainment. Phase IV – 380 Operate may continue as continuity of service until month 36, the end of the 381 Period of Performance. 382

Version 1.0, 2019-07-05 Page | 15

6.5 Phase V – Transition Out (End Support) or Transition to Production/Sustainment 383 of the approved Pilot Solution (Up to 60 Days). This Phase begins at any point in 384 time when the Government issues a written determination that the EITaaS 385 Provider has failed to meet the performance of this SOO (at any Phase) and so 386 directs a Transition Out, or no later than when the Government issues a 387 determination that Phase IV objectives have been met, and issues a directive to 388 Transition to Production/Sustainment. 389

6.5.a Transition Out – Should the Government direct a Transition Out, the EITaaS 390 Provider is tasked to return the IT service levels – including all Army data – at all 391 of the Pilot Sites designated in the Agreement Award impacted to the level of 392 operational capability prior to the initiation of the pilot activities or better. Data 393 transfers will be completed as required from the EITaaS Solution to a designated 394 Government location (e.g. Data Center). This includes the transfer of the EITaaS 395 Solution Phase I – IV relevant deliverable items in Table 2 – EITaaS Data 396 Deliverables List. The Government will collaborate with the EITaaS Provider to 397 plan in detail the tasks required for any Transition Out and the actual time-line 398 required. 399

6.5.b Transition to Production – Should the Government direct a Transition to 400 Production, the EITaaS Provider is tasked prepare a plan and a Performance 401 Work Statement for a 36 month Production Period of Performance (commencing 402 after the Pilot concludes). Additional instructions and a list of deliverables will be 403 provided by the Government. The EITaaS Solution will remain in service under 404 the Phase IV Operate conditions with no break of service or support. 405

6.6 Schedule Constraints – Reference Figure 3, Notional EITaaS Schedule. The 406 initiation for each phase at each designated Pilot Site (e.g. Pilot Site 1, 2 & 3) is 407 dependent on Government funding and approval. Approval for Phase II – V is 408 also dependent on the EITaaS provider completing the tasks for the previous 409 phase. For the FY19 funded Pilot Sites, and for the planned Pilot Period of 410 Performance, the Internet Access Point (IAP) for all EITaaS Solutions will be 411 provided by the Government. Therefore, a commercial solution for IAP is not in 412 Scope of this SOO. 413

7. Data Deliverables and Delivery Schedule: 414 The EITaaS Provider shall deliver the data items listed in the table below as the 415 minimum (the Government and or the EITaaS Provider may define others) in the 416 EITaaS Provider’s commercial and Government approved format (approval will be after 417 award). Content shall also be defined by the EITaaS Provider with Government 418 approval. The EITaaS Provider may use any applicable Government Data Item 419 Description (DID) references only as a starting guide. 420

The Pilot Deliverable Data Items (Minimum list) shall be made available [delivered] to 421 the Government on a schedule that supports the activities of each of Phases I – V and 422 the requirement to demonstrate successful performance of the Phase before moving to 423

Version 1.0, 2019-07-05 Page | 16 the next phase. Timing must support any required decisions and/or resource 424 allocations. 425

Table 2 – EITaaS Data Deliverables List, all numbered items to be submitted and/or 426 made available in a digital file format appropriate for the item (title) that is readable by 427 an End User on an End User Device (examples include Dashboards (depicting live 428 and/or historical data), flat files in Microsoft Office ® (2013) and/or Adobe®) by the 429 EITaaS Government Project Management Office and Functional Management Office. 430

Table 2 – EITaaS Data Deliverables List 431

Line of Effort

**EITaaS Pilot Deliverable Data Items (Minimum list) Delivered with the following

Rights

All LOEs

1) Network & Security Logs

2) Network: Architecture Diagrams (All defined levels of detail), Configuration Data and Internet Protocol (IP) addressing schema

3) Network Availability, Performance & Latency

4) Cybersecurity Readiness/ Risk Status

5) Change Control Board Plan/Process/Workflow

6) Configuration Management

7) Quality of Service Status: Network, Devices, etc.

8) Future Technology Roadmap

9) Continuity of Operations, Data Recovery and Restoration (to include Recovery Point Objective) Asset Visibility/ Management

10) Service Interruption

11) Integrated Master Schedule, organized by Work Breakdown Structure (WBS), resource loaded with EITaaS Provider/Solution and Government resources (as appropriate), (continually updated during each Phase)

12) Usage Status of the Solution, Network, Device, Service or Platform

13) Working EITaaS Solution Cost Model, (updated at each Phase)

Government Purpose Rights

(GPR)

LOE 1.1

NaaS

1) Active Directory Diagram

2) Usage Status: Network & Bandwidth

3) Data Recovery Status

GPR

LOE 1.2

EUS

1) Asset Availability, Inventory and Provisioning

2) Service Desk Logs: By user type

3) End user device status report (availability, distribution)

4) End user services status report (availability, allocation)

GPR

LOE 1.3

C&S

1) Export of data (to Army Analytic Platforms)

2) Transmitted data (export report)

3) Usage Status: Storage and Processing

GPR

**NOTE: All EITaaS Solution Deliverable Data is to be delivered with at least Government 432 Purpose Rights. See Agreement Terms and Conditions. 433

Version 1.0, 2019-07-05 Page | 17

8. Government Furnished Material, Equipment and Information: 435 After agreement award, the Government will provide the EITaaS Provider access to 436 requisite program and technical information necessary to carry out the requirements of 437 this document. No access or surveys will be granted prior to award. 438

8.1 All Government generated data residing on or transmitting through the EITaaS 439 Solution will remain as “Government Data”. 440

8.2 The Government will provide access to facilities, equipment, software tools, and 441 technical information necessary for the performance of this Agreement (e.g., 442 information on EAMS-A and access for site surveys). Material items may also 443 include office space, desks, telephones, printers, access to electronic mail, and 444 computers, when deemed appropriate by the Government. 445

8.3 The Government will provide approvals of EITaaS Solution Software and 446 Hardware as needed for all LOEs. 447

8.4 EITaaS Provider personnel will not use Government resources in violation of any 448 federal, State, or Local statute, regulation or policy. 449

8.5 EITaaS Provider personnel identified to access Government networks must 450 possess the requisite training and clearances (e.g. favorable Single Scope 451 Background Investigation (SSBI), Security+, etc.) 452

9. EITaaS Provider Furnished Material and Equipment (as a Service): 454 The EITaaS Provider is responsible to furnish all of the material (hardware/software) 455 and the required Data Items to implement the EITaaS Solution. Any co-use of 456 Government materials and/or equipment will be determined after the Phase 1 457 assessment and must be mutually agreed to. 458

At the conclusion of the EITaaS Pilot, (see Phases IV & V above) the Government and 459 the EITaaS Provider will complete a joint inventory of the EITaaS Provider furnished 460 software and hardware material and equipment (by LOE) that is installed or in-service at 461 a Government designated Pilot Site, Government operated facility or under the control 462 of (in the possession of) Government end users. The joint inventory will include an 463 assessment and joint determination of the transfer of ownership to the Government. 464

a) If the EITaaS Pilot ends with a Transition Out and will not proceed to 465 Production/Sustainment, the Government intends to assume ownership of any 466 hardware material and equipment installed on a Government Installation or 467 Government operated facility or assigned to the end users. 468

b) If the Pilot ends with a transition to Production/Sustainment, the joint inventory 469 will support the assessment for the planning of a Production start. 470

Version 1.0, 2019-07-05 Page | 18

10. Travel Requirements: 473 The EITaaS Provider shall support Government directed meetings as needed. All travel 474 costs (Lodging, per diem, air fare, rental car etc.) shall be included in the proposed 475 price. The Government will reimburse travel in accordance with the General Services 476 Administration (GSA) published Per Diem rate(s) for the time period of the travel. 477 Transportation costs will be reimbursed at GSA Mileage rates, or economy/coach level 478 means of transportation (e.g., car/plane/train). EITaaS Provider personnel are 479 responsible for making their own travel and lodging arrangements as necessary to 480 support Pilot requirements. The EITaaS Provider will plan to support all the tasks at 481 the three (3) designated Pilot sites to implement the EITaaS Solution. 482

11. Period of Performance: 484 The Phases I – V are interdependent and non-severable for the entire period of 485 performance. The period of performance will conclude at the direction of the 486 Government or on completion of the full extent of the Pilot or 36 months, whichever 487 comes first. The Government will make a determination for Phase V Transition and the 488 Pilot will officially conclude with completion of the Transition to production/sustainment 489 or Transition Out. 490

12. Place of Performance: 492 The EITaaS Provider may utilize their own facilities when executing the work 493 associated with this SOO. The Government will select the three designated Pilot Sites 494 (and group them by Pilot Site Set, where each Set includes one site that is Small, 495 Medium and Large) through a deliberate decision process and include them in the 496 award agreement. The EITaaS Provider shall support meetings and tasks at the three 497 designated Pilot Sites during the period of performance. In addition, the EITaaS 498 Provider shall support meetings and coordination with the Program Management 499 Office and Functional Management Office at locations on Fort Belvoir, VA and at 500 designated locations in the National Capital Region. The Government reserves the 501 right to identify and assign additional EITaaS Installations and locations for the overall 502 EITaaS Pilot. 503

13. Security: 505 Reference the EITaaS Pilot DD Form 254, Contract Security Classification 506 Specification. The nature of this Pilot requires access to, handling, receiving and 507 storing classified (Secret (to include Sensitive Compartmented Information (SCI)) and 508 Confidential) and Controlled Unclassified Information (CUI), Personally Identifiable 509 Information, Personal Health Information, unclassified information, documents, 510 hardware and software using the applicable standards of DoD 5220.22-M National 511 Industrial Security Program (NISPOM). The work performed by the EITaaS Provider 512 will require access to Secret, (Sensitive Compartmented Information Facilities (SCIF)), 513 Controlled Unclassified Information facilities and work spaces. The EITaaS Provider 514

Version 1.0, 2019-07-05 Page | 19 personnel will be required to attend meetings at classified and unclassified levels. See 515 Enclosure 0002 Army EITaaS Personnel Security Requirements for details. 516

14. Milestone Payment Schedule: 517 The following table represents the payable Milestones: (instruction: prepopulated with 518 Example milestones and example dates, please tailor to your specific proposal timeline. 519 Ensure each description begins with the applicable Phase of performance. Note: the 520 CLIN structure will have a Parent CLIN i.e. 1001 to represent the total Phase value and 521 subCLINs to represent each payable milestone. Milestones must be measurable and 522 meaningful events. Milestone values and frequencies may be subject to negotiation: 523 examples include if they are unevenly distributed, too frequent, not considered 524 meaningful, not able to be measured. Delete this instruction prior to submission) 525

Table 3 – EITaaS Milestone Payment Schedule 526 Milestone Number

Milestone Description No Later Than Due Date

(Days after award)

Amount

01 Phase I – Assessment Completion 30 $ 02 Phase II – Acceptance of Draft ‘Plan’ 90 $ 03 Phase II – Purchase of Long Lead Items for

Phase III 120 $

04 Phase II – Acceptance of Final Phase II Reports 180 $ 05 Phase III –

Version 1.0, 2019-07-05 Page | 20

Enclosures 528

Enclosure 0001: Army EITaaS Initial Requirements Document 529

Enclosure 0002: Army EITaaS Personnel Security Requirements 531

Enclosure 0003a1-4: Army EITaaS Fact Sheets Ft Benning (Supplemental 533 Information Only, not for initial award) 534

Enclosure 0003b1-4: Army EITaaS Fact Sheets Ft Polk (Information for Initial Award) 536

Enclosure 0003c: Army EITaaS AFC Fact Sheet-LOE (Marked FOUO; Information for 538 Initial Award) 539

Enclosure 0003d1-2: Army EITaaS Camp Roberts Fact Sheets (Marked FOUO, 541 Information for Initial Award) 542

Enclosures TBD: Service Level Agreement (SLA) Standards, to be added at/after 544 Agreement Award 545

TBD.a. SLA Across All LOEs 547 To be provided by the EITaaS Provider and agreed to by the Government. 548

TBD.b. SLA for Line of Effort (LOE) 1.1 Network as a Service 550 To be provided by the EITaaS Provider and agreed to by the Government. 551

TBD.c. SLA for LOE 1.2 End User Service (EUS) 553 To be provided by the EITaaS Provider and agreed to by the Government. 554

TBD.d. SLA for LOE 1.3 Compute and Store 556 To be provided by the EITaaS Provider and agreed to by the Government. 557